<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>
      Based on R.Fontugne et al. COST-TMA 2010
    </description>
        <url>
      http://www.fukuda-lab.org/~romain
    </url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
        <analyst>
      
    </analyst>
        <organization>
      
    </organization>
    </analysis>
    <dataset>
        <description>
      MAWI
    </description>
        <url>
      http://tracer.csl.sony.co.jp/mawi/
    </url>
    </dataset>
    <anomaly type="anomalous" value="1.47567,1.33352,999,1 1 1 0 0 0 0 0 0 1 1 0,ipv4gretun">
        <slice>
            <filter src_ip="203.77.118.23" dst_ip="206.195.243.0"/>
            <filter src_ip="203.77.118.23" dst_ip="204.51.214.225"/>
            <filter src_ip="203.77.118.23" dst_ip="50.248.138.222"/>
            <filter src_ip="203.77.118.23" dst_ip="128.246.133.160"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.48602,2.0155,999,1 1 0 1 1 1 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="71.134.61.143" dst_ip="203.77.119.225" dst_port="123"/>
            <filter src_ip="71.134.61.143" dst_ip="203.77.118.80" dst_port="123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47567,1.33352,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="198.244.43.162" dst_port="8291"/>
            <filter src_ip="198.244.43.162" dst_port="22"/>
            <filter src_ip="198.244.43.162" dst_port="8728"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.56728,1.33527,504,1 1 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.24.211.178" src_port="443"/>
            <filter src_ip="8.11.184.20" dst_ip="202.24.211.178" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.76503,1.44264,999,1 1 1 0 0 0 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="91.221.199.208" src_port="5067" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8648,1.48503,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="121.163.81.223" dst_port="6379"/>
            <filter src_ip="27.19.113.68" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.47567,1.33352,010,1 1 1 0 0 0 0 0 0 1 1 0,ntscSYN">
        <slice>
            <filter src_ip="111.183.96.102" dst_port="10216"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.4953,1.32174,999,1 1 1 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="91.249.19.64"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.60589,2.07886,504,1 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.130.172" src_port="443"/>
            <filter dst_ip="163.194.71.196" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.79917,2.15225,010,1 1 1 1 1 1 0 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="27.165.235.107" dst_port="8291"/>
            <filter src_ip="27.165.235.107" dst_port="8728"/>
            <filter src_ip="27.165.235.107" dst_port="22"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.58362,2.09533,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.130.64" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.58362,2.09533,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.196.247" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.58362,2.09533,504,0 0 0 1 1 1 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.1.158" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.78613,1.62319,504,1 1 0 1 1 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="202.252.244.36" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.40909,1.39215,504,1 1 1 1 0 0 1 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="163.194.1.158" dst_ip="13.84.171.236"/>
            <filter src_ip="163.194.1.158" dst_port="443"/>
            <filter dst_ip="13.84.171.236" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="7.38683,6.69326,999,1 1 1 1 0 0 1 1 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="91.249.19.64"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.85292,2.18804,010,1 1 1 1 1 1 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="47.232.38.107" dst_port="2379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43898,1.33068,504,1 0 0 0 0 0 0 0 0 1 1 1,ptmpla">
        <slice>
            <filter src_ip="203.77.126.213" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.73138,1.57127,999,0 0 0 1 1 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.77.112.51" src_port="3389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8491,1.49552,010,1 1 1 0 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="31.172.154.15" src_port="64333"/>
            <filter src_ip="106.112.137.149" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.16384,1.70352,503,1 1 0 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="203.77.119.217" dst_port="53"/>
            <filter dst_ip="203.77.118.161" dst_port="80"/>
            <filter dst_ip="163.194.97.106" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.79917,2.15225,503,1 1 1 1 1 1 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="203.77.118.161" dst_ip="223.117.134.246" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32369,1.78016,010,1 1 1 1 1 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="163.194.18.205" src_port="32674" dst_port="7778"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.32369,1.78016,504,1 1 1 1 1 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="198.244.40.252" dst_ip="163.194.3.69" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.71.252" src_port="443"/>
            <filter dst_ip="163.194.6.79" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52225,1.40127,010,0 0 0 1 0 0 1 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="78.101.117.36" src_port="8080"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45911,1.31888,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.180.238" src_port="443"/>
            <filter dst_ip="163.194.131.140" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.58362,2.09533,999,0 0 0 1 1 1 0 0 0 1 1 1,ntscUDPOther">
        <slice>
            <filter src_ip="141.15.40.62" src_port="4040" dst_port="5060"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45911,1.31888,504,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.143.60" src_port="443"/>
            <filter dst_ip="163.194.18.132" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,999,0 0 0 0 0 0 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="133.152.234.52" dst_ip="45.115.84.31" src_port="23389"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.66796,2.0893,504,1 1 0 1 1 1 0 0 0 1 1 1,alphfl">
        <slice>
            <filter src_ip="202.252.244.214" dst_ip="13.84.75.153" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.60589,2.07886,020,1 0 0 1 1 1 0 0 0 1 1 1,ntscICec">
        <slice>
            <filter src_ip="163.171.190.51"/>
            <filter src_ip="157.71.159.254"/>
            <filter src_ip="218.240.123.109"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.43898,1.33068,504,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="117.107.183.233" dst_ip="163.194.129.32"/>
            <filter src_ip="117.107.183.233" src_port="443"/>
            <filter dst_ip="163.194.129.32" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.8.193" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="163.194.23.46" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.8648,1.48503,010,1 1 1 1 0 0 1 0 0 1 1 1,ntscSYN">
        <slice>
            <filter src_ip="185.187.162.25"/>
            <filter src_ip="1.204.110.173" dst_port="6379"/>
            <filter src_ip="42.226.65.172" dst_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.76503,1.44264,504,1 1 1 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.128.17" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.85292,2.18804,504,1 1 1 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="203.77.113.23" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.60589,2.07886,503,1 0 0 1 1 1 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="163.194.97.106" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.52225,1.40127,020,0 0 0 1 0 0 1 0 0 1 1 1,ntscICecrqICecrprp">
        <slice>
            <filter dst_ip="54.183.234.124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="38.233.245.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.115.208"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.41894,1.34469,504,0 0 0 1 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.180.208" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.166.9" src_port="443"/>
            <filter dst_ip="163.194.166.9"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.64176,2.13208,504,0 0 0 1 1 1 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.75.139" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="202.252.244.97" dst_ip="13.222.106.186" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,010,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="133.106.129.130" dst_port="8645"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.130.123" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.130.178" src_port="443"/>
            <filter dst_ip="163.194.130.178" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.128.158" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55975,1.37652,504,1 0 0 1 0 0 1 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.247.63.89" src_port="53"/>
            <filter dst_ip="202.247.63.89" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.129.86" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.66355,2.1159,504,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.1.121" src_port="443"/>
            <filter dst_ip="163.194.129.150" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.128.214" src_port="443"/>
            <filter dst_ip="163.194.4.46" src_port="443"/>
            <filter dst_ip="163.194.71.45" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="163.194.70.119" src_port="443"/>
            <filter dst_ip="163.194.70.119" src_port="33434"/>
            <filter dst_ip="163.194.70.119" src_port="5004"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.66355,2.1159,010,1 0 0 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="203.77.119.220"/>
            <filter src_ip="167.200.125.58"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.85292,2.18804,010,1 1 1 1 1 1 1 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="45.112.55.158" src_port="56279"/>
            <filter src_ip="146.119.11.148" src_port="1901" dst_port="1900"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,010,0 0 0 0 0 0 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="167.200.125.43"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.45911,1.31888,503,1 0 0 1 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.71.76"/>
            <filter dst_ip="163.194.171.43" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,504,0 0 0 0 0 0 0 0 0 1 1 1,mptpla">
        <slice>
            <filter dst_ip="18.155.153.149" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.39824,1.35627,999,0 0 0 0 0 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter dst_ip="202.24.212.219"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.55975,1.37652,504,1 0 0 1 0 0 1 0 0 1 1 1,mptmp">
        <slice>
            <filter dst_ip="163.194.18.214" src_port="443"/>
            <filter dst_ip="203.77.113.102" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="35.113.55.188" dst_port="22"/>
            <filter src_ip="35.113.55.188" dst_port="5432"/>
            <filter src_ip="35.113.55.188" dst_port="6379"/>
            <filter src_ip="35.113.55.188" dst_port="7001"/>
        </slice>
        <from usec="0" sec="1631163679"/>
        <to usec="0" sec="1631163715"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27412,1.34685,999,1 1 1 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="198.244.94.115" src_port="9000"/>
            <filter dst_ip="163.194.70.222" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="83.221.135.161" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1631164214"/>
        <to usec="0" sec="1631164263"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982029,1.23115,504,1 1 0 1 0 0 0 0 0 1 0 0,alphfl">
        <slice>
            <filter src_ip="54.208.114.117" dst_ip="163.194.130.49" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20842,1.22934,504,1 1 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="163.194.128.108" dst_ip="116.123.80.8" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27818,1.43289,999,1 1 1 0 0 0 1 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="23.122.85.26" src_port="5178" dst_port="5060"/>
        </slice>
        <from usec="0" sec="1631164249"/>
        <to usec="0" sec="1631164383"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.251.65.240" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1631164106"/>
        <to usec="0" sec="1631164306"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.251.65.245" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1631163989"/>
        <to usec="0" sec="1631164390"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="45.115.84.0" dst_port="22"/>
        </slice>
        <from usec="0" sec="1631164242"/>
        <to usec="0" sec="1631164252"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="37.79.65.195" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164232"/>
        <to usec="0" sec="1631164234"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="154.105.249.198" dst_port="1433"/>
            <filter src_ip="154.105.249.198" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164028"/>
        <to usec="0" sec="1631164033"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="202.81.75.170" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631163745"/>
        <to usec="0" sec="1631163746"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="111.246.145.150" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164235"/>
        <to usec="0" sec="1631164237"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="218.8.145.121" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631163792"/>
        <to usec="0" sec="1631163793"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.154.18.78" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164130"/>
        <to usec="0" sec="1631164132"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.206.79.251" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1631163683"/>
        <to usec="0" sec="1631163845"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="120.211.129.33" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164008"/>
        <to usec="0" sec="1631164010"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="109.60.69.254" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164224"/>
        <to usec="0" sec="1631164226"/>
    </anomaly>
    <anomaly type="suspicious" value="1.27818,1.43289,010,1 1 1 0 0 0 1 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="208.66.100.43" dst_port="443"/>
        </slice>
        <from usec="0" sec="1631163780"/>
        <to usec="0" sec="1631163826"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.184.25.93" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1631163643"/>
        <to usec="0" sec="1631164288"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.254.129.177" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164044"/>
        <to usec="0" sec="1631164046"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="59.217.130.184" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164089"/>
        <to usec="0" sec="1631164090"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="1.66.219.202" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164077"/>
        <to usec="0" sec="1631164186"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="91.237.12.57" dst_port="1900"/>
        </slice>
        <from usec="0" sec="1631164299"/>
        <to usec="0" sec="1631164494"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="121.3.186.113" dst_port="6379"/>
        </slice>
        <from usec="0" sec="1631164134"/>
        <to usec="0" sec="1631164136"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="117.205.68.132" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631163951"/>
        <to usec="0" sec="1631163953"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="42.213.25.87" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164026"/>
        <to usec="0" sec="1631164028"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="183.118.184.145" dst_port="1433"/>
            <filter src_ip="183.118.184.145" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164124"/>
        <to usec="0" sec="1631164131"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="59.179.84.159" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631163985"/>
        <to usec="0" sec="1631163988"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="164.220.248.155" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631163982"/>
        <to usec="0" sec="1631163986"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="112.100.13.80" dst_port="1433"/>
            <filter src_ip="112.100.13.80" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164440"/>
        <to usec="0" sec="1631164446"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="58.50.48.183" dst_port="5555"/>
        </slice>
        <from usec="0" sec="1631163904"/>
        <to usec="0" sec="1631163951"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="175.98.176.112" dst_port="3389"/>
        </slice>
        <from usec="0" sec="1631163816"/>
        <to usec="0" sec="1631163835"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,004,1 1 1 0 0 0 0 0 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="112.100.18.180" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164335"/>
        <to usec="0" sec="1631164338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="113.193.131.119" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164452"/>
        <to usec="0" sec="1631164454"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="202.188.241.132" dst_port="1433"/>
            <filter src_ip="202.188.241.132" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164006"/>
        <to usec="0" sec="1631164012"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="78.75.178.55" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631163781"/>
        <to usec="0" sec="1631163782"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="221.238.74.40" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164094"/>
        <to usec="0" sec="1631164095"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="116.26.91.56" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631163660"/>
        <to usec="0" sec="1631163666"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="123.192.236.222" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164040"/>
        <to usec="0" sec="1631164042"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="42.198.171.26" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164168"/>
        <to usec="0" sec="1631164172"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="119.75.200.224" dst_port="65533"/>
        </slice>
        <from usec="0" sec="1631163917"/>
        <to usec="0" sec="1631163923"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,sntscSYN">
        <slice>
            <filter src_ip="164.227.151.12" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164419"/>
        <to usec="0" sec="1631164423"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.251.65.241" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1631164289"/>
        <to usec="0" sec="1631164290"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="222.24.49.10" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631164295"/>
        <to usec="0" sec="1631164297"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17823,1.36621,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDPOther">
        <slice>
            <filter src_ip="185.251.65.244" dst_port="5351"/>
        </slice>
        <from usec="0" sec="1631163920"/>
        <to usec="0" sec="1631164416"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="121.3.186.113" src_port="6379"/>
        </slice>
        <from usec="0" sec="1631164134"/>
        <to usec="0" sec="1631164136"/>
    </anomaly>
    <anomaly type="suspicious" value="1.15322,1.37761,010,1 1 1 0 0 0 0 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="112.100.18.180" src_port="445"/>
        </slice>
        <from usec="0" sec="1631164335"/>
        <to usec="0" sec="1631164337"/>
    </anomaly>
    <anomaly type="suspicious" value="0.941785,1.38674,010,0 0 1 0 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="192.43.109.42" dst_port="1433" proto="tcp"/>
        </slice>
        <from usec="0" sec="1631163746"/>
        <to usec="0" sec="1631163747"/>
    </anomaly>
    <anomaly type="suspicious" value="1.10196,1.40233,010,0 1 1 0 0 0 0 0 0 0 0 0,ntscSYN139445">
        <slice>
            <filter src_ip="5.18.240.45" dst_port="445"/>
        </slice>
        <from usec="0" sec="1631164149"/>
        <to usec="0" sec="1631164150"/>
    </anomaly>
    <anomaly type="suspicious" value="0.982029,1.23115,999,1 1 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="198.244.46.93" dst_port="443"/>
            <filter dst_ip="198.244.46.93" dst_port="8801"/>
            <filter src_ip="202.6.185.236" dst_ip="52.223.0.54" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.2968,1.33519,010,1 1 1 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="175.98.176.112" src_port="3389"/>
            <filter dst_ip="3.238.126.14" src_port="6379"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.44627,1.61855,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1631163600"/>
        <to usec="0" sec="1631164338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.44627,1.61855,901,0 0 0 0 1 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1631163600"/>
        <to usec="0" sec="1631164338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.46629,1.60886,504,0 0 0 1 1 0 0 0 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="203.77.109.51" dst_ip="20.83.222.21" dst_port="443"/>
        </slice>
        <from usec="0" sec="1631163716"/>
        <to usec="0" sec="1631163855"/>
    </anomaly>
    <anomaly type="suspicious" value="1.56647,1.65644,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="163.194.222.76" src_port="53"/>
        </slice>
        <from usec="0" sec="1631163600"/>
        <to usec="0" sec="1631164338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.56647,1.65644,999,0 0 0 1 1 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="203.77.114.199" dst_port="53"/>
        </slice>
        <from usec="0" sec="1631163600"/>
        <to usec="0" sec="1631164336"/>
    </anomaly>
    <anomaly type="suspicious" value="1.70566,1.80958,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter dst_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1631163600"/>
        <to usec="0" sec="1631164338"/>
    </anomaly>
    <anomaly type="suspicious" value="1.70566,1.80958,901,0 0 0 0 0 1 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="0.0.0.0"/>
        </slice>
        <from usec="0" sec="1631163600"/>
        <to usec="0" sec="1631164338"/>
    </anomaly>
    <anomaly type="suspicious" value="0.969977,1.27577,020,1 0 0 1 0 0 1 0 0 1 0 0,icmp_error">
        <slice>
            <filter dst_ip="51.143.170.240"/>
            <filter dst_ip="124.95.243.13"/>
            <filter dst_ip="125.135.222.170"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17823,1.36621,010,1 1 1 1 0 0 0 0 0 0 0 0,ntscSYN">
        <slice>
            <filter src_ip="60.3.148.174" dst_port="1433"/>
        </slice>
        <from usec="0" sec="1631163604"/>
        <to usec="0" sec="1631164032"/>
    </anomaly>
    <anomaly type="suspicious" value="1.06439,1.21152,999,1 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="198.244.88.91" dst_ip="163.194.171.58" src_port="8801" dst_port="64727"/>
            <filter src_ip="198.244.88.91" dst_ip="163.194.171.58" src_port="8801" dst_port="64180"/>
            <filter src_ip="198.244.88.91" dst_ip="163.194.171.58" src_port="8801" dst_port="62127"/>
            <filter src_ip="198.244.88.91" dst_ip="163.194.171.58" src_port="443" dst_port="62385"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03713,1.22688,504,0 0 0 1 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="203.77.121.39" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03713,1.22688,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.129.189" src_port="443"/>
            <filter dst_ip="163.194.129.189"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.22273,1.26169,504,1 0 0 1 0 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="216.147.220.69" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03713,1.22688,010,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="91.11.88.83" src_port="22"/>
            <filter dst_ip="91.11.88.83" src_port="8291"/>
            <filter dst_ip="91.11.88.83" src_port="8728"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="103.11.42.212" dst_ip="163.194.70.153" src_port="80" dst_port="64482"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="123.90.221.42"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03713,1.22688,504,0 0 0 1 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="140.193.23.166" src_port="443"/>
            <filter dst_ip="163.194.130.206" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.03713,1.22688,504,0 0 0 1 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.71.203" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="163.194.81.141" dst_ip="76.192.253.130" dst_port="443"/>
            <filter src_ip="163.194.81.141" dst_ip="13.197.181.188" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.17451,1.28864,999,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="54.188.112.113" dst_port="5802"/>
            <filter dst_ip="3.38.23.123"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="167.200.125.61"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="192.63.83.79" dst_ip="203.77.118.51" src_port="4500" dst_port="4500"/>
            <filter src_ip="192.63.83.79" dst_ip="203.77.118.51"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.24.212.165"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,010,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="202.24.212.183" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,999,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="210.155.54.159" src_port="443"/>
            <filter dst_ip="163.194.129.75" src_port="443"/>
            <filter dst_ip="163.194.129.137" src_port="443"/>
            <filter dst_ip="163.194.130.226" src_port="443"/>
            <filter src_ip="210.155.54.159" dst_ip="163.194.129.75" src_port="9000"/>
            <filter src_ip="210.155.54.159" dst_ip="163.194.129.137" src_port="9000"/>
            <filter src_ip="210.155.54.159" dst_ip="163.194.130.226" src_port="9000"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,504,0 0 0 0 0 0 0 0 0 1 1 0,ptmpla">
        <slice>
            <filter src_ip="76.192.253.130" dst_ip="163.194.81.141" src_port="443"/>
            <filter src_ip="76.192.253.130" dst_ip="163.194.81.140" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,504,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="202.252.242.45" dst_ip="13.222.94.7" src_port="51108" dst_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.131.117" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,504,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.71.136" src_port="443"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,004,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.24.213.174" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,004,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="202.24.213.183" dst_port="445"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,999,0 0 0 0 0 0 0 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="163.194.130.90"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.20842,1.22934,999,1 1 0 0 0 0 0 0 0 1 1 0,ptmp">
        <slice>
            <filter src_ip="202.252.244.241" dst_ip="163.194.131.6"/>
            <filter src_ip="202.252.244.241" dst_port="3481"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.00863,1.23956,503,0 0 0 0 0 0 0 0 0 1 1 0,alphflHTTP">
        <slice>
            <filter src_ip="163.194.97.55" dst_ip="91.189.39.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
